CVE-2026-107383: MariaDB Connector/Node.js Exposes Uninitialized Memory Through Malformed GeoJSON Parameters
Summary
CVE-2026-107383: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters. Affects mariadb across 4 version ranges.
< 3.2.5
>= 3.3.0, < 3.3.4
>= 3.4.0, < 3.4.7
>= 3.5.0-rc.0, < 3.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mysql-client · Bitnami
- mariadb-min · Bitnami
- mariadb · Bitnami
The same CVE-2026-107383 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. The MariaDB Connector/Node.js allows Node.js applications to connect to MariaDB databases, providing a seamless interface for executing queries and managing data. This connector is designed to handle various data types, including GeoJSON, which is commonly used for representing geographical features. However, a vulnerability has been identified in the way the connector processes GeoJSON Polygon and MultiPolygon parameters, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from improper handling of GeoJSON parameters in the MariaDB Connector/Node.js. When encoding a GeoJSON Polygon or MultiPolygon, the connector incorrectly sizes its output buffer based on the length property of each ring. If a ring is not a real array but carries a numeric length, the buffer is allocated but not written to, leading to uninitialized memory being exposed. This uninitialized memory can contain sensitive information from other users in a shared Node.js process, such as session tokens, database credentials, and other request data. The vulnerability is silent, meaning the insert operation succeeds, but the column may contain more bytes than intended, leading to potential data leaks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.53.2.5npm install mariadb@3.2.5 -
>= 3.3.0, < 3.3.43.3.4npm install mariadb@3.3.4 -
>= 3.4.0, < 3.4.73.4.7npm install mariadb@3.4.7 -
>= 3.5.0-rc.0, < 3.5.43.5.4npm install mariadb@3.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, validate that GeoJSON coordinates are properly nested arrays of numbers before passing the object as a parameter to execute() or batch(). Alternatively, use the query() method, which is not affected by this vulnerability.
Conclusion
The CVE-2026-107383 vulnerability in the MariaDB Connector/Node.js poses a significant risk by exposing uninitialized memory through malformed GeoJSON parameters. It is crucial for developers to update to the patched versions and implement the recommended workarounds to protect sensitive information from being leaked.
See every vulnerability recorded for mariadb →
FAQ
CVE-2026-107383 is a vulnerability in the MariaDB Connector/Node.js that exposes uninitialized memory through malformed GeoJSON parameters.
If your application uses the affected versions of the MariaDB Connector/Node.js and processes GeoJSON parameters, it may inadvertently leak sensitive information from uninitialized memory.
You should update to one of the patched versions (3.2.5, 3.3.4, 3.4.7, or 3.5.4) to mitigate the risk associated with this vulnerability.
Yes, you can validate GeoJSON coordinates before passing them to the connector or use the query() method instead of execute() or batch().
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
